Guest post originally published on Magalix’s blog by Andrew Zola

GitOps teams are shifting security left. This is fantastic news for anyone looking for a solid and efficient plan to secure applications, infrastructure, and other processes within the entire ecosystem.

The primary objective is to improve outcomes and reduce the time spent on security. GitOps comes with a whole host of benefits out-of-the-box. These include improving enterprise infrastructure management protocols, accelerated development, and (of course) improved security.

What is GitOps?

GitOps is a development approach that leverages code version control based on Git. It’s also automated often. This means that Git defines and controls workflows and synchronizes them across systems. This means that you can add version control to every aspect of a container-based continuous integration/continuous delivery or deployment (CI/CD) environment.

Git has evolved into a standard for developers working on both open-source and proprietary software development projects. There are also many different ways to follow GitOps practices, but for the most part, we follow best practices set by Weaveworks (a startup that coined the term and of the strongest advocates of GitOps).

GitOps is popular as Git is the only interface where developers can interact and collaborate while integration and deployment processes are fully automated. This approach enables the auditability of all infrastructure templates, complete version control, and improved developer velocity.

GitOps methodology also embraces the concept of continuous security. This approach ensures that security is at the heart of each iteration, allowing developers to eliminate all errors and vulnerabilities long before your application goes live.

To secure GitOps flows with security-as-code, follow these steps:

1- Apply Critical Permission Management

Whenever you build applications on Git, the current development stage can seamlessly converge towards the desired state. GitOps is essentially a suite of processes that allows convergence towards the desired state.

You can leverage the tools and features offered by version control providers using permission management. If you set up your environment in an organized manner, you can easily assign ownership, quality gates and enable different types of access.

However, no modifications will take place without proper approval. In this case, you should define the owners and make sure the team audits specific changes.

GitOps forces teams to think about everything included in the environment-as-code. So, you’ll have infrastructure-as-code (IaC), configuration-as-code (CaS), policy-as-code (PaC), security-as-code (SaC), and anything else you can think of as code.

But don’t store your secrets as code!

In contrast to DevSecOps, GitOps is a little more prescriptive when it comes to implementation. It uses Git as a single source of truth for the entire environment.

2- Incorporate Security Scanning Early

GitOps allows you to automate more of the deployment process. GitOps developers must write the code, test locally, and submit a pull/merge request. Once you commit the code, it’s important to move on after providing the necessary tools for security scanning.

It’s always better to start security scanning as early as possible in the software development life cycle (SDLC). This approach also allows software engineers to provide feedback in a manner they have grown accustomed to.

Your VCS and CI pipelines are an excellent place to start embedding security scanning of the infrastructure codebase.

3- Embed Security Across the SDLC

It’s critical to enforce security and compliance using PaC across the SLDC. In this scenario, it’s best to scan your IaC template before committing it to a Git repository. This approach ensures constant and continuous feedback for developers.

Whenever you have continuous and frequent feedback, you can fix errors and misconfigurations quickly. Regular security scanning also ensures that you enforce the latest security best practices and catch potential issues in the code.

4- Enforce Critical Data Management

Confidential information in Git is dangerous (remember the Uber data breach?). This is because the code committed to the git repository can quickly spread across multiple locations. As a result, encrypting sensitive data is a business imperative.

However, keeping critical business data confidential is a challenge, and available options tend to be complex. As such, all secrets must be secured and controlled throughout each step in the GitOps workflow.

If you’re wondering why we still choose to store sensitive data on GitHub, the answer is simple. Git allows revision history of all changes, backs up sensitive data, provides secure access to sensitive data, and offers a uniform approach to source code management.

5- Encourage Actionable Feedback

GitOps best practices demand that you quickly resolve security issues that come up during the SLDC. This is the best way to ensure significant speed and agility. Without addressing security issues proactively, you risk creating friction within the GitOps development team.  

You should also concentrate on the end-user or developers when embedding and enforcing security protocols. This is because developers are notorious for circumventing it all together when security is unintuitive.

Product owners and project managers should take it upon themselves to make it easy for developers to comply with security protocols. In this case, you should create remediation and prioritization guidelines with offending line items.

6- Avert Cloud Drift

Use hosted IaC templates and version-controls in your repository to make changes to your cloud environment. You can also enforce all immutable infrastructure and reconciliation loops by leveraging the same templates.

It’s important to note that fixing issues by making manual changes to running resources can occasionally lead to cloud drift. This makes it critical to have proper visibility and monitoring in place for automated security scanning. This method will also help hold your development team accountable to cloud drift.

Whenever there’s cloud drift, you must revert back to the previous state immediately. Alternatively, you can add countermeasures to the templates and push them through the pipeline into runtime environments.

IaC templates must be identical to the picture of the deployed infrastructure. Even if you have a slight discrepancy, you can create significant risk when your code goes into production.

7- Audit and Track Progress Continuously

The implementation of applications or infrastructure doesn’t end when all your code is in production. This makes auditing critical to deploy entire applications and infrastructure.

We can define auditability as an examination of records to verify their accuracy. In this case, it’ll be a systematic evaluation to determine how well everything conforms to previously established criteria.

You must analyze and compare things like logging, monitoring, and traceability. As Git already has an auditing tool, it stores all logs related to any changes made to the single source of truth. As GitOps audits take many forms, Git stores logs and custom metadata in the cloud.

When you audit and track progress, you can resolve existing misconfigurations by quickly patching them. When you actively engage in this activity, you should set a benchmark. With consistent exposure to security feedback, your team may subconsciously prevent potential errors. They might even go the extra mile to find and fix them on their own.

8- Security Should Be the Norm

GitOps only works when there’s seamless collaboration. As such, GitOps engineers can’t deploy infrastructure without putting it through some suitable security guardrails (without assuming that it’s perfect).

The best way to ensure success is to get both developers and security teams to work closely together. This approach will help improve processes with each iteration. It’s also crucial to work with your security team to ascertain what can pass through and what can’t. They can also share their knowledge and tips with developers on what works and what doesn’t.

When all this comes together, you will be able to fortify your security posture. When there’s close collaboration and agreement between all stakeholders, it’ll be easier to implement automation protocols.

Secure Your GitOps Workflows with Magalix

Secure Your GitOps Flows with Security-as-Code

Figure: Security-as-code embedded in GitOps Workflows

At Magalix, we’re in the business of programmatically enforcing security standards with PaC. When GitOps teams integrate PaC and SaC within their workflows, it helps build secure developer-centric experiences with continuous deployment for cloud-native applications.

Organizations can also apply governance standards across clusters with a single click when enforcing PaC, deploy policy checks across cloud environments, and validate infrastructure compliance protocols.

This approach also allows development teams to create and enforce a centralized playbook across the SLDC. This will help accelerate development, implement best practices, and automate security protocols across iterations.

SaC in GitOps will also go a long way in boosting innovation and time-to-market.